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DETAILED ACTION 

1. This action is responsive to communications filed on July 1 1, 2005. Claims 1-40 are 
pending in this office action. 

Claim Rejections -35 USC §103 

2. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

3. Claims 1-5 and 21-25 are rejected under 35 U.S.C. 103(a) as being unpatentable over Ayi 
et al. (hereinafter "Ayi", Pub. No.: US 2002/0143735) in view of Hart (5,787,428). 

As per claim 1, Ayi teaches a method for managing access to data in a database subject to 
a plurality of label-based security policies, the method comprising the steps of: 

receiving, within a database management system, a request for performing an operation 
set of one or more operations on data in a table of the database (Ayi, page 1, [0006] - [0008]); 

determining which policies, of the plurality of label-based policies, apply to the table 
based on a policy set of one or more policies associated with the table( Ayi, page 1, [0006] - 
[0008]). 

Ayi discloses determining whether to perform an operation/access on a dataset based on 
the label associated with the dataset (Ayi, page 1, [0006]). Ayi does not explicitly disclose 
whether to perform the operation on a row, of the table. Hart teaches determining whether to 
perform the operation on a row of the table based on a set of labels associated with the row (Hart, 
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Fig. 4-8, col. 6, lines 5-19). Therefore, it would have been obvious to one of ordinary skill in the 
art at the time the invention was made to modify the access control system of Ayi by 
incorporating determining whether to perform the operation on a row of the table based on a set 
of labels associated with the row as disclosed by Hart (Hart, Fig. 4-8, col. 6, lines 5-19). The 
motivation being to provide different security level and access management for different rows in 
the table. 

As per claim 2, Ayi and Hart teach all the claimed subject matters as discussed in claim 

1, and further teach adding a policy column to the table for each policy in the policy set 
associated with the table (Hart, Fig. 4). 

As per claim 3, Ayi and Hart teach all the claimed subject matters as discussed in claim 

2, and further teach storing a label, of the set of labels associated with the row, in a 
corresponding policy column of the row (Hart, Fig. 4). 

As per claim 4, Ayi and Hart teach all the claimed subject matters as discussed in claim 
2, and further teach said step of determining which policies apply further comprising the step of 
determining whether a column is a policy column (Hart, Fig. 4-8, col. 6, lines 5-19). 

As per claim 5, Ayi and Hart teach all the claimed subject matters as discussed in claim 
1, and further teach the policy set associated with the table includes two or more policies of the 
plurality of label-based policies (Ayi, page 1, [0006]-[0008], Hart, Fig. 4-8). 

Claims 21-25 are rejected on grounds corresponding to the reasons given above for 
claims 1-5. 
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4. Claims 6-20 and 26-40 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Hayman et ah (hereinafter "Hayman", 5,859,966) in view of Ayi et al. (hereinafter "Ayi", Pub. 
No.: US 2002/0143735 Al). 

As per claim 6, Hayman discloses a method for managing access to data in on a policy set 
of one or more label-based security policies, the method comprising the steps of: 

registering one or more packages of routines, wherein each package of said one or more 
packages implements a security model that supports a model set of one or more policies of the 
policy set and said each package includes an access mediation routine (Hayman, col. 8, line 67 - 
col. 9, line 14, col. 9, line 56 - col. 10, line 4, Hayman teaches incorporate and installation 
security software which inherently includes registering one or more package of routines, 
furthermore, applicant admits that registering one or more packages of routines are well known 
in the art, please see specification, page 17, 2 nd to last line - page 18, line 2); 

associating a first policy of a first model set in a first package with an object (Hayman, 
col. 5, lines 18-60, Hayman teaches labels/policies are applied to each object. Please note the 
labels are plural, which inherently includes a first policy, a second policy, etc); and 

invoking the access mediation routine in the first package to determining whether to 
allow operation on data based on the first policy (Hayman, col. 3, line 44 - col. 4, line 50, col. 9, 
line 55 - col. 10, line 4). 

Hayman teaches the security policy is applied to an object, however, Hayman does not 
explicitly disclose the object is a first table within the database system. Ayi teaches applies 
labels to tables in the database system (Ayi, page 1, [0006]-[0008]). Therefore, it would have 
been obvious to one of ordinary skill in the art at the time the invention was made to modify the 
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security system of Hayman by applying the labels/policies to tables in the database system as 
disclosed by Ayi. The motivation being to control access to the data in a table of the database 
system. 

As per claim 7, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 6, and further teach forming said each package of said one or more packages so that the 
access mediation routine conforms to a specified interface for enforcing a policy in the database 
management system (Hayman, col. 9, lines 1-13). 

As per claim 8, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 7, and further teach said each package further comprising including one or more 
administrative routines for defining a policy for the model set (Hayman, col. 9, line 55 - col. 10, 
line 4). 

As per claim 9, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 8, and further teach one or more administrative routines for defining a policy further 
comprising including one or more administrative routines for defining a name for a particular 
policy; labels for the particular policy; descriptions for the labels; and properties for the labels 
(Hayman, col. 5, lines 18-60). 

As per claim 10, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 6, and further teach invoking an administrative routine of the first package for defining the 
first policy (Hayman, col. 5, lines 18-60). 

As per claim 1 1, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 10, and further teach invoking the administrative routine of the first package further 
comprising providing to the administrative routine of the first package a plurality of parameters 
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including a policy name for the first policy and a plurality of label names for labels of the first 
policy (Hayman, col. 5, lines 18-60, col. 6, lines 45-67). 

As per claim 12, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 6, and further teach in response to attempts to operate on data in a row in the table, the step 
of determining that the first policy applies to the table (Hayman, col. 5, lines 25-39, Ayi, page 1, 
[0006]-[0008]). 

As per claim 13, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 6, and further teach associating a second policy of a second model set in a second package 
with a second table within the database system; and invoking the access mediation routine in the 
second package for determining whether to allow operation on data in the second table based on 
the second policy (Ayi, page 1, [0006]-[0008]). 

As per claim 14, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 13, and further teach the second model in the second package is the same as the first model 
in the first package (Hayman, col. 5, lines 25-60, Ayi, page 1, [0006]-[0008]). 

As per claim 15, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 13, and further teach the second model in the second package is different from the first 
model in the first package (Hayman, col. 5, lines 25-60, Ayi, page 1, [0006]-[0008]). 

As per claim 16, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 13, and further teaches the second table is the same as the first table (Hayman, col. 5, lines 
25-60, Ayi, page 1, [0006]-[0008]). 
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As per claim 17, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 13, and further teach the second table is different from the first table (Hayman, col. 5, lines 
25-60, Ayi, page 1, [0006]-[0008]). 

As per claim 18, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 6, and further teach invoking the access mediation routine in the first package further , 
comprising providing data indicating the first policy to the access mediation routine (Hayman, 
col. 9, line 55 - col. 10, line 4). 

As per claim 19, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 6, and further teach the method further comprises the step of determining a set of allowed 
labels for the first policy for a user of the database management system; said step of invoking the 
access mediation routine is performed during said step of determining the set of allowed labels; 
and the user is allowed to operate on the data according to the first policy if the data is associated 
with a label for the first policy and the label is included in the set of allowed labels for the first 
policy (Hayman, col. 5, lines 25-60, col. 9, line 55 - col. 10, line 4). 

As per claim 20, Hayman and Ayi teach all the claimed subject matters as discussed in 
claim 19, and further teach storing the set of allowed labels in a session cache for a 
communication session between the database management system and the user (Hayman, col. 8, 
lines 54-67, Ayi, page 1, [0006]-[0008]). 

Claims 26-40 are rejected on grounds corresponding to the reasons given above for 
claims 6-20. 
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Response to Arguments 

5. Applicant's arguments filed on July 11, 2005 have been fully considered but they are not 
persuasive. 

6. The declaration and Exhibit A, B, C and D filed on October 22, 2004 under 37 CFR 
1.131 have been considered but are ineffective to overcome the Ayi et al. (Pub. No.: 
2002/0143735 Al). 

First, the Declaration Under 37 CFR 1.131 filed on October 22, 2004 is defective because 
the Declaration is not signed by all the inventors [See MPEP 704, 715]. Only Rae K. Burns 
signed and dated the Declaration, Other inventors (Patrick F. Sack and Vikram Reddy Pesati) did 
not sign the Declaration. Therefore, it is defective. 

The Declaration Under 37 CFR 1.131 attempts to show conception of the invention prior 
to the effective date of the reference 03/30/2001 coupled with due diligence from prior to the 
reference data to the filing date 1 1/30/2001 of the application (constructive reduction to 
practice). 

The evidence submitted is insufficient to establish a conception of the invention prior to 
the effective date of the Ayi reference. While conception is the mental part of the inventive act, 
it must be capable of proof, such as by demonstrative evidence or by a complete disclosure to 
another. Conception is more than a vague idea of how to solve a problem. The requisite means 
themselves and their interaction must also be comprehended. See Mergenthaler v. Scudder, 
1897 CD. 724, 81 O.G. 1417 (D.C, Cir. 1897). 
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I. Conception 

A) A conception of an invention, through evidenced by disclosure, drawing, 
and even a model, is not a complete invention under the patent laws, and confers no 
rights on inventor, and has no effect on a subsequently granted patent to another, 
UNLESS THE INVENTORS FOLLOWS IT WITH REASONABLE DILIGENCE BY 
SOME OTHER ACT. 

B) General allegation that the invention was completed prior to the data of the 
reference is not sufficient. Ex parte Saunders, 1883 CD. 23.23 O.G. 1224 (Comm'r Pat. 183). 
Similarly, a declaration by the inventor to the effect that his or her invention was conceived or 
reduced to practice prior to the reference date, without a statement of facts demonstrating the 
correctness of this conclusion, is insufficient to satisfy 37 CFR 1.131. 

C) The affidavit or declaration and exhibits must clearly explain which facts 
or data application is relying on to show completion of his or her invention prior to the particular 
date. 

D. When reviewing a 37 CFR 1.131 affidavit or declaration, the examiner 
must consider all of the evidence presented in its entirely, including the affidavits or declarations 
and all accompanying exhibits, records and "notes." However, in the affidavits the applicant 
recited "We conceived and reduced to practice an implementation of claims 1-5 and 21-25 before 
the effective filing date of Ayi (paragraph 3), [and] we participated on a team that developed the 
implementation of claims 1-5 and 21-25 ...we completed before the effective filing date of Ayi 
(paragraph 4)". The requirement for the conception is more than a vague idea of how to show 
the problem; the means themselves and their interaction must be comprehended also. The 
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applicant also must give a clear explanation of the exhibits pointing out exactly what facts are 
established and relied on by application. The statement which recited in paragraph 3 and 4 are 
general allegation that the invention was complete prior to the date of the reference 03/30/2001 
without a statement of facts demonstrating the correctness of this conclusion, is insufficient to 
satisfy 37 CFR 1.131. 

II. Deligence 

A. In determining the sufficient of a 37 CFR 1.131 affidavit or declaration, 
diligence need not be considered unless conception of the invention prior to the effective date is 
clearly establish, since deligence come into question only after prior conception is establish. Ex 
parte Kantor, 177 USPQ 455 (Bd. App. 1958). 

B. The critical period in which deligence must be shown begins just prior to 
the effective date of the reference 03/30/2001 or activity and ends with the date of a reduction to 
practice, either actual or constructive (i.e., filing a United States patent application). 

C. The conception occurs prior to the date of the reference, but reduction to 
practice afterward^ it is not enough merely to allege that applicant or patent owner had been 
deligence. The exhibit(s) which was demonstrated by the application was not clearly explain 
which facts or data applicant is relying on to show completion of his or her invention prior to the 
filing date 1 1/30/2001 in determining the sufficiency of 37 CFR 1.131, the critical period in 
which diligence must be shown begin just prior to the effective date of the reference 03/30/2001 
or activity ends with the date of a reduction to practice, either actual or constructive. 

DI. Claims or Claims limitation is not comprehended by the exhibits. 
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A. Exhibit does not support the limitations "receiving, within a database 
management system, a request for performing an operation set of one or more operations on data 
in a table of the database"; "determining which policies, of the plurality of label-based policies, 
apply to the table based on a policy set of one or more policies associated with the table"; and 
"for each operation in the operation set, determining whether to perform the operation on a row 
of the table based on a set of labels associated with the row, the set of labels corresponding to the 
policy set". Please explicitly indicate which evidence the applicant relies on to support each 
limitation. 

Therefore, the DECLARATION UNDER 37 C.F.R. 1.131 filed on 1 0/22/2004 has been 
considered but is ineffective to overcome the Ayi reference, based on the three reasons: 

A. The affidavit or declaration and exhibits must clearly explain which facts or data 
application is relying on to show completion of his or her invention prior to the particular date. 
The conception is more than of how to show the problem; the means themselves and their 
interaction must be comprehended also. The applicant also must give a clear explanation of the 
exhibits pointing out exactly what facts are established and relied on by application. The 
statement which recited in paragraph 2, 3 and 4 are general allegation that the invention was 
complete prior to the date of the reference 03/30/2001 without a statement of facts demonstrating 
the correctness of this conclusion, is insufficient to satisfy 37 CFR 1.131. 

B. The conception occurs prior to the date of the reference, but reduction to practice 
afterward, it is not enough merely to allege that applicant or patent owner had been deligence. 
The exhibit(s) which was demonstrated by the application was not clearly explain which facts or 
data applicant is relying on to show completion of his or her invention prior to the filing date 
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1 1/30/2001 in determining the sufficiency of 37 CFR 1.131, the critical period in which diligence 
must be shown begin just prior to the effective date of the reference 03/30/2001 or activity ends 
with the date of a reduction to practice, either actual or constructive. 

C. The exhibits must be comprehended to one ordinary skill in the art and concepts 
must support by accompanying with the claims. 

7. As per applicant's arguments regarding the references does not teach registering one or 
more packages of routines, wherein each package of said one or more packages implements a 
security model that supports a model set of one or more policies of the policy set and said each 
package includes an access mediation routine have been considered but are not persuasive. 
Hayman teaches incorporate and installation security software which inherently includes 
registering one or more package of routines and the package includes access mediation routine 
(Hayman, col. 8, line 67 - col. 9, line 14, col. 9, line 56 - col. 10, line 4), furthermore, applicant 
admits that registering one or more packages of routines are well known in the art (please see 
specification, page 17, 2 nd to last line - page 18, line 2). Therefore, the arguments are not 
persuasive. 

Contact Information 
Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Chongshan Chen whose telephone number is (571) 272-4031. 
The examiner can normally be reached on Monday - Friday (8:00 am - 4:30 pm). 
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If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, John Breene can be reached on (571) 272-4107. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Chongshan Chen 

October 1, 2005 /T *~^> 




